EUVD-2026-72507

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

CVE-2026-86491

JetBrains YouTrack versions prior to 2026.2.18634 were affected by a stored XSS vulnerability exploitable through project and organization icon uploads . An attacker with high privileges (e.g., an authenticated user with project or organization admin rights) could inject malicious scripts that ex...

CVE-2026-86489

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

CVE-2026-86491

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

CVE-2026-86491

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

Malicious Package

Overview btree-range-store is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @quantixfinance/config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @quantixfinance/sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-11817

In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...

CVE-2026-85211 Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

EUVD-2026-70482

Helicone's VaultManager.getDecryptedProviderKeyById function in the GET /v1/vault/key/providerKeyId endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream...

CVE-2026-85178

Helicone 's VaultManager.getDecryptedProviderKeyById() function on the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. An attacker with admin or owner privileges in any single organization can retrieve decr...

Malicious Package

Overview bella-bakwan35-riris is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bellatrix-aldebaran-hexo-prettier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview bella-martabak31-breki is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview bellatrix-axios-spica-geoarchaeology is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview bella-otak-otak99-ruro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview bella-nasicampur87-breki is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-84485

APITable versions through 1.13.0-beta.1 expose an internal organization loadOrSearch endpoint without requiring authentication. This allows unauthenticated attackers to retrieve member names, email addresses, and team hierarchy by querying the endpoint with space identifiers obtained from shared ...

CVE-2026-84485 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or...